GLSA-200404-15 : XChat 2.0.x SOCKS5 Vulnerability

The remote host is affected by the vulnerability described in GLSA-200404-15 XChat 2.0.x SOCKS5 Vulnerability The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and...

GLSA-200401-01 : Linux kernel do_mremap() local privilege escalation vulnerability

The remote host is affected by the vulnerability described in GLSA-200401-01 Linux kernel domremap local privilege escalation vulnerability The memory subsystem allows for shrinking, growing, and moving of chunks of memory along any of the allocated memory areas which the kernel possesses. A...

GLSA-200403-05 : UUDeview MIME Buffer Overflow

The remote host is affected by the vulnerability described in GLSA-200403-05 UUDeview MIME Buffer Overflow By decoding a MIME archive with excessively long strings for various parameters, it is possible to crash UUDeview, or cause it to execute arbitrary code. This vulnerability was originally...

GLSA-200404-02 : KDE Personal Information Management Suite Remote Buffer Overflow Vulnerability

The remote host is affected by the vulnerability described in GLSA-200404-02 KDE Personal Information Management Suite Remote Buffer Overflow Vulnerability A buffer overflow may occur in KDE-PIM's VCF file reader when a maliciously crafted VCF file is opened by a user on a vulnerable system. Impa...

GLSA-200404-14 : Multiple format string vulnerabilities in cadaver

The remote host is affected by the vulnerability described in GLSA-200404-14 Multiple format string vulnerabilities in cadaver Cadaver code includes the neon library, which in versions 0.24.4 and previous is vulnerable to multiple format string attacks. The latest version of cadaver uses version...

Gaim: New vulnerabilities

Background Gaim is a multi-protocol instant messaging client for Linux which supports many instant messaging protocols. Description Gaim fails to do proper bounds checking when: Handling MSN messages partially fixed with GLSA 200408-12. Handling rich text format messages. Resolving local hostname...

INL ulog-php port.php proto Parameter SQL Injection

The remote host is running ulog-php, a firewall log analysis interface written in PHP. There is a SQL injection vulnerability in the remote interface, in the 'port.php' script that may allow an attacker to insert arbitrary SQL statements into the remote database. An attacker may exploit this flaw...

AWStats rawlog.pm logfile Parameter Arbitrary Command Execution

The remote host is running AWStats, a free real-time logfile analyzer. The AWStats Rawlog Plugin which is installed is prone to an input validation vulnerability. The issue exists in the 'logfile' URI data passwed to the 'awstats.pl' script. An attacker may exploit this to execute commands remote...

Mantis < 0.18.1 Multiple Unspecified XSS

According to its banner, the remote version of Mantis contains a flaw in the handling of some types of input. Because of this, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected website. %NASLMINLEVEL 7030...

Mantis < 0.18.3 / 0.19.0a2 Multiple Vulnerabilities

According to its banner, the remote version of Mantis contains multiple flaws that may allow an attacker to use it to perform a mass emailing, to inject HTML tags in the remote pages, or to execute arbitrary commands on the remote host if PHP's 'registerglobals' setting is enabled. %NASLMINLEVEL...

Mandrake Linux Security Advisory : libpng (MDKSA-2004:079)

Chris Evans discovered numerous vulnerabilities in the libpng graphics library, including a remotely exploitable stack-based buffer overrun in the pnghandletRNS function, dangerous code in pnghandlesBIT, a possible NULL pointer crash in pnghandleiCCP which is also duplicated in multiple other...

Mozilla contains a buffer overflow in the SendUidl() function

Overview A vulnerability in the way Mozilla handles certain types of POP3 responses could allow a remote attacker to execute arbitrary code on an affected system. Description Post Office Protocol Version 3 POP3 is a mail protocol that provides a means for retrieving email from a remote server. Th...

Low: Red Hat Security Advisory: pam security update

Updated pam packages that fix a security vulnerability are now available for Red Hat Enterprise Linux 2.1. PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set an authentication policy without having to recompile programs that handle...

WU-FTPD rnfr File Overwrite

The remote WU-FTPD server seems to be vulnerable to a remote flaw. This version contains a flaw that may allow a malicious user to overwrite arbitrary files. The issue is triggered when an attacker sends a specially formatted rnfr command. This flaw will allow a remote attacker to overwrite any...

xine-lib: VCD MRL buffer overflow

Background xine-lib is a multimedia library which can be utilized to create multimedia frontends. Description xine-lib contains a bug where it is possible to overflow the vcd:// input source identifier management buffer through carefully crafted playlists. Impact An attacker may construct a...

acroread: UUDecode filename buffer overflow

Background acroread is Adobe's Acrobat PDF reader for Linux. Description acroread contains two errors in the handling of UUEncoded filenames. First, it fails to check the length of a filename before copying it into a fixed size buffer and, secondly, it fails to check for the backtick shell...

kdebase, kdelibs: Multiple security issues

Background KDE is a powerful Free Software graphical desktop environment for Linux and Unix-like Operating Systems. Description KDE contains three security issues: Insecure handling of temporary files when running KDE applications outside of the KDE environment DCOPServer creates temporary files ...

[ GLSA 200408-06 ] SpamAssassin: Denial of Service vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200408-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

Dropbear SSH Server DSS Verification Failure Remote Privilege Escalation

The remote host is running Dropbear prior to version 0.43. There is a flaw in this version of Dropbear that could enable a remote attacker to gain control of the system from a remote location. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid14234; scriptversion"1.21";...

BasiliX Message Content XSS

The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions are vulnerable to cross-scripting attacks since they do not filter HTML tags when showing a message. As a result, an attacker can include arbitrary HTML and script code in a message and have that code executed b...